Review Results

Comment

The only change is to redirect the two source tarball URLs from the official MakeMKV download site to a SourceForge project named `fabiololix-os-archive`. That is a significant supply-chain red flag: the package would now fetch upstream source archives from an unrelated third-party mirror/fork rather than the official vendor, with no evidence in this diff that the mirror is authoritative or that checksums were updated to preserve integrity. Because `.SRCINFO` drives AUR metadata, this can mislead users/builders into trusting a non-official source. I do not see any direct code execution or install-script changes in this hunk, so the risk is moderate rather than maximal, but the source substitution is suspicious enough to warrant review of the actual PKGBUILD and checksums before trusting the package.

@@ -13,8 +13,8 @@ pkgbase = makemkv
 	depends = ffmpeg
 	depends = libavcodec.so
 	optdepends = java-runtime: bdjava https://www.makemkv.com/bdjava/
-	source = https://www.makemkv.com/download/makemkv-bin-1.18.4.tar.gz
-	source = https://www.makemkv.com/download/makemkv-oss-1.18.4.tar.gz
+	source = https://sourceforge.net/projects/fabiololix-os-archive/files/src/makemkv-bin-1.18.4.tar.gz
+	source = https://sourceforge.net/projects/fabiololix-os-archive/files/src/makemkv-oss-1.18.4.tar.gz
 	source = ffmpeg9.patch
 	source = makemkv.1
 	source = makemkvcon.1

Comment

The change replaces the official MakeMKV source tarball URLs with tarballs hosted on a third-party SourceForge project (`fabiololix-os-archive`) while keeping the same checksums. That is a supply-chain integrity regression: the package is now trusting an unrelated mirror/archive rather than the upstream site, and the PKGBUILD no longer makes it obvious that the fetched artifacts are the official releases. Although the hashes still pin the exact contents, this introduces unnecessary dependency on an external archive and weakens provenance. No direct code execution or install-script changes are present in this hunk, so the risk is moderate rather than severe.

@@ -13,12 +13,15 @@ license=('LicenseRef-GuinpinSoft-inc-EULA' LGPL-2.1-or-later)
 depends=(qt5-base ffmpeg libavcodec.so)
 optdepends=('java-runtime: bdjava https://www.makemkv.com/bdjava/')
 install=makemkv.install
-source=(${url}/download/${pkgname}-bin-${pkgver}.tar.gz
-        ${url}/download/${pkgname}-oss-${pkgver}.tar.gz
-        ffmpeg9.patch
-        makemkv.1
-        makemkvcon.1
-        )
+source=(
+    #${url}/download/${pkgname}-bin-${pkgver}.tar.gz
+    #${url}/download/${pkgname}-oss-${pkgver}.tar.gz
+    https://sourceforge.net/projects/fabiololix-os-archive/files/src/makemkv-bin-1.18.4.tar.gz
+    https://sourceforge.net/projects/fabiololix-os-archive/files/src/makemkv-oss-1.18.4.tar.gz
+    ffmpeg9.patch
+    makemkv.1
+    makemkvcon.1
+    )
 sha256sums=('cee56de0baa5531abed16bd862742d308d772b4ab4dae16ee865bf74f04a1608'
             '8590063648d42ec2a958b74573d7022f0f4c334e4e4fe7dd53b70c6e748ba453'
             'd35ae9e841ac43297e17a08d8819b339c5058bbdfc150fab508a442365756929'